The Agent Skills Directory

[REMOTE_CODE_EXECUTION] (CRITICAL): The documentation explicitly provides examples of using the Python eval() function to process tool arguments. Since these arguments are generated by an LLM, an attacker can use prompt injection to execute arbitrary Python code on the user's host machine. Evidence found in references/tool-builder.md and references/agent-patterns.md in the handle_tool functions.
[DATA_EXFILTRATION] (HIGH): The documentation in references/files.md describes an 'Automatic File Upload' feature where local file paths provided in the input dictionary are automatically uploaded to the inference.sh servers. If an agent is tricked into outputting a sensitive path (e.g., '/etc/passwd' or '~/.aws/credentials'), the SDK will automatically exfiltrate these files.
[COMMAND_EXECUTION] (HIGH): Multiple files (e.g., references/agent-patterns.md) demonstrate enabling .code_execution(True) as an internal tool. While presented as a feature, it grants the agent direct shell/code execution capabilities which, if not strictly sandboxed, leads to full host compromise.
[CREDENTIALS_UNSAFE] (MEDIUM): The documentation consistently demonstrates hardcoding API keys in initialization: inference(api_key="inf_..."). While using placeholders, it promotes the unsafe practice of embedding secrets directly in code rather than using environment variables.
[INDIRECT_PROMPT_INJECTION] (MEDIUM): The 'RAG Pattern' and 'Search Tool' examples in references/agent-patterns.md describe ingesting untrusted web data into the agent's context. There is no mention of sanitization, boundary markers, or 'ignore embedded instructions' warnings, making implementations following these patterns highly vulnerable to indirect prompt injection.

python-sdk